Information Management Assessment Action Plan Review

The Department for Culture, Media and Sport

December 2012 Background The Information Management Assessment (IMA) programme is the best-practice model for government bodies wishing to demonstrate commitment to the principles of good information management.

An IMA of The Department for Culture, Media and Sport (DCMS) was conducted at the department’s offices in Whitehall in February 2010. The department’s IMA report was agreed in August 2010 and published in spring 2012 on The National Archives’ website. Progress against the department’s IMA action plan was reviewed in December 2012 and is summarised below. Work required to address outstanding recommendations is detailed at the end of this document under ‘Next Steps’.

Key findings of the 2010 IMA The IMA report gave DCMS a ‘Good’ rating for re-use on the IMA performance framework risk matrix. Performance under a further four headings was rated as ‘Acceptable’. The report identified nine ‘Development needed’ performance areas and six ‘Priority Attention’ areas.

The IMA report made a total of 54 recommendations for improvement, giving particular attention to the following:

- DCMS had no strategy, vision or plan for information management. The role of information management in supporting business objectives was not defined or communicated corporately.
- DCMS had no nominated board champion with corporate responsibility for information management. The department had not defined performance measures for information management and there was no evidence that key information management related risks and issues were regularly reported at board level.
- DCMS had defined the risks associated with the information it held to a limited degree. Understanding of information risk was focussed narrowly on the security of personal information and there was no evidence that risks beyond this were being identified and reported. • DCMS had no defined structure for Information Management. No compliance checking with policy was undertaken.

• While DCMS recognised the need for a Departmental Records Officer, it had not defined ongoing resourcing requirements. At times the role had fallen vacant leaving DCMS with no identifiable strategic policy lead. The department had minimal oversight of records transfer and appraisal.

• The department had made a start in defining business critical information but had not fully defined the value of its information or what information it needed to keep.

• Staff did not consistently recognise in practice the sensitivity of the information the department held. Standards of information management were found to be inconsistent.

Progress against recommendations DCMS has undergone a period of realignment and restructuring following agreement of the department’s 2010 Comprehensive Spending Review settlement. DCMS is consequently a smaller department today than it was at the time of the IMA, with a growing emphasis on flexible project-based working.

Future provisions for information management are currently being reviewed by the Knowledge and Information Management (KIM) project established as a component of the overall DCMS Change Programme. This aims to establish a proportionate approach to information management within the department. The project was on hold for the period of the 2012 London Olympic Games, restarting in September of that year.

Work to address recommendations made in the 2010 IMA report remains at an early stage. However, the assessment team notes the following developments:

• DCMS has now identified its requirements for the role of Departmental Records Officer, which fell vacant in early 2012. DCMS is currently in the process of recruiting for that role.

- The KIM project, reporting to the Corporate Committee, has raised the profile of information management and related risks. It has sought to define and gain agreement on ownership of information management at a senior and operational level.

- The KIM project has identified and communicated the need for behavioural rather than systems change and emphasised the need for a strong mandate and leadership from the senior management team.

- The KIM project has also sought to agree the future approach to storage of digital information and records. DCMS aims to streamline its EDRMS, Livelink; planned work is to include the establishment of standardised project filing structures, and may extend to consideration of restrictions on the use of personal repositories.

- DCMS has recognised the need for better retention and sharing of corporate knowledge. Work in this area includes development of a handover report process to capture key role specific information. It includes a section on file and records management. This document has been built into the Leaver’s checklist for development managers.

**Next Steps**

Implementation must be the next step now that priorities have been identified, and the department must ensure ongoing support to effect necessary levels of change. At the same time, DCMS should liaise with The National Archives to ensure it can take advantage of available support, networks and other opportunities. The outcomes of the KIM project have the potential to provide a solid base for information management within the department. Work in the areas below would address key concerns highlighted in the DCMS IMA report and help ensure DCMS has the right foundations in place:

- DCMS must ensure that the role of DRO is positioned to enable oversight and control of paper and digital records, to perform decisions regarding the appraisal, selection and review of records due for transfer to The National Archives. • DCMS should also ensure that the DRO role is positioned to exert strategic influence on the direction of digital information management within the department.

• DCMS must clearly communicate the role of good information management in tackling information risk and enabling transparency. As a key component of this, the department must ensure senior sponsorship for knowledge and information management, to champion the agenda and demonstrate its ongoing importance.

• DCMS should produce a documented high-level strategy or plan for information management with milestones to provide continuity and draw key goals together. This will enable overlapping and parallel work streams to be drawn together and viewed in context as coherent components of a single programme.

• DCMS recognises the need to produce clear guidance for information management that is adopted by staff. DCMS should fully review and revise existing policy to ensure it addresses key information risks and establishes necessary standards in line with legal and business requirements. To support this work, DCMS should ensure that information’s value in supporting strategic and day to day outcomes is clearly stated at a high level for staff, and actively promoted.

• DCMS has recognised the need to develop performance measures. As a first step, it is important to gain an understanding of where information is being stored and in what quantities. To gain full assurance it is necessary to assess the quality as well as the volume of information stored. DCMS should consider how these measures will be reported and used to target key risk areas, driving adherence to policy.

• Although the KIM project has raised at a senior level information risks beyond the security of personal information, information risk is not currently represented on the departmental risk register. In order to effectively address such risks, DCMS should ensure that they are defined and documented at a strategic level.

• DCMS does not have a plan to consistently address risks to the completeness and availability of digital information. The National Archives offers Digital Continuity training, advice and guidance that would help DCMS build its capability in this regard.

- This would have particular benefit in enabling development of the department’s Information Asset Register, which does not currently support consistent description of risks, value or usage requirements. By expanding its Information Asset Register in line with The National Archives guidance and as laid out in the Knowledge Council’s Information Principles, DCMS would be more able to effectively protect, manage and exploit the information assets it holds.

The assessment team will continue to working closely with DCMS through the action plan monitoring process and standard meetings with the departmental Information Management Consultant. Further progress review meetings will be scheduled to measure progress against outstanding recommendations.

Following agreed closure of the action plan, progress against any outstanding recommendations will be reviewed at the time of the next formal IMA in 2015.

**Risk Matrix** The table recognises progress made by DCMS since the original assessment.

| Governance and Leadership | Assessed 2010 | Reviewed 2012 | |---------------------------|--------------|--------------| | Strategic management | | | | Business objectives | | | | Management controls | | | | Resourcing | | | | Risk management | | | | Records Management | | | |------------------------------------|---|---| | Creation | | | | Storage | | | | Appraisal, disposal and transfer | | | | Sustainability of digital records | | | | Management | | | | Access to Information | | | | FOI/Data Protection | | | | Re-Use | | | | Security | | | | Compliance | | | | Staff responsibilities and delegations | | | | Policies and guidance | | | | Training | | | | Change management | | | | Culture | Commitment | Staff Understanding | Knowledge Management | |------------------|------------|---------------------|----------------------| | | | | |

| Key to colour coding | |----------------------| | ![Best Practice](image) | Best Practice | | ![Good](image) | Good | | ![Satisfactory](image) | Satisfactory | | ![Development Needed](image) | Development Needed | | ![Priority Attention Area](image) | Priority Attention Area |